1a98f12d3b46cf3da6a836162fbe06f0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1a98f12d3b46cf3da6a836162fbe06f0N.exe
Size

628KB
MD5

1a98f12d3b46cf3da6a836162fbe06f0
SHA1

a114ff5e148bdcec0ae15504f338c616b3659a4a
SHA256

6a2a1a3e8a10ae5945e907cf1ce107e1a9f04da6e5fab725e20bfaa1fe0225fa
SHA512

309d7e803e9cf94085a33d2e86e0e73aefb755c25c1d1e05b6debad0d588d2d869c48744efcc386f79e89fe3b799bdc73cfe1cc6d5db424a753a6ffe4b0c4d80
SSDEEP

12288:R9qgV9teJZHfYC5tmZ2pEGsc7tXP8MijVvK+il6KPr189:zaJZHfYMtm9Gs2f8MEVSbRBC

Score

1^/10

Malware Config

Signatures

Files

1a98f12d3b46cf3da6a836162fbe06f0N.exe
.dll regsvr32 windows:5 windows x86 arch:x86

a06712ad8bc54214d3588e626b2f0e83

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

aa:6b:28:4a:0d:6f:33:40:00:00:00:00:55:65:ea:89
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

11/12/2015, 18:06

Not After

11/12/2017, 18:36

Subject

CN=F5 Networks Inc,O=F5 Networks Inc,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\cc-builds\apmclients715x-win\901240\src\rh\TerminalProxy\InstallerControl\out\Release\InstallerControl.pdb

Imports

kernel32

GetSystemTime
GetFileSize
GetCurrentProcessId
FormatMessageA
GetLocaleInfoA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
CopyFileA
QueryPerformanceCounter
CreateProcessA
CreateMutexA
GetSystemInfo
GetTickCount
GetExitCodeProcess
MoveFileExA
Sleep
SetFileAttributesA
TerminateThread
GetVersion
GetCurrentThread
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpA
ReadFile
WriteFile
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
FlushFileBuffers
CreateFileW
GetFileAttributesExA
GetTempFileNameA
CreateEventA
EnumResourceLanguagesA
WaitNamedPipeA
SetNamedPipeHandleState
GetTempPathA
GetSystemDirectoryA
RemoveDirectoryA
GetCurrentDirectoryA
ExpandEnvironmentStringsA
WaitForSingleObject
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
WriteConsoleW
SetStdHandle
GetStartupInfoW
SetHandleCount
GetFileType
LCMapStringW
HeapSize
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleFileNameW
GetStdHandle
ExitProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCommandLineA
CreateThread
ExitThread
SetFilePointer
GetConsoleMode
GetConsoleCP
EncodePointer
DecodePointer
VirtualQuery
FindNextFileA
LocalFree
LocalAlloc
lstrcpyW
GetSystemTimeAsFileTime
CreateFileA
GetFileTime
CompareFileTime
ReleaseMutex
GetWindowsDirectoryA
WaitForMultipleObjects
MultiByteToWideChar
ResetEvent
SetEvent
InitializeCriticalSection
CreateDirectoryA
GetFileAttributesA
LoadLibraryA
FindFirstFileA
FindClose
CloseHandle
CallNamedPipeA
DeleteFileA
LoadLibraryExA
FreeLibrary
SetLastError
GetModuleFileNameA
IsDBCSLeadByte
FindResourceA
LoadResource
LockResource
SizeofResource
DisableThreadLibraryCalls
OutputDebugStringA
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
MulDiv
GetCurrentProcess
FlushInstructionCache
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
GetModuleHandleW
VirtualProtect
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
WideCharToMultiByte
SetCurrentDirectoryA

user32

DefWindowProcA
UnionRect
PtInRect
CallWindowProcA
ShowWindow
GetWindowLongA
SetWindowLongA
CharNextA
UnregisterClassA
SetFocus
IsChild
GetFocus
DestroyWindow
IsWindow
InvalidateRect
GetKeyState
RegisterClassExA
CreateWindowExA
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
GetForegroundWindow
MsgWaitForMultipleObjects
LoadStringA
BeginPaint
MessageBoxA
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
LoadCursorA
GetClassInfoExA

gdi32

LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateDCA
CreateRectRgnIndirect
GetDeviceCaps

advapi32

RegOpenKeyExA
RegDeleteKeyA
MapGenericMask
RegCreateKeyA
RegQueryInfoKeyA
RegEnumValueA
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegOpenKeyA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
StringFromCLSID
CoGetObject
StringFromGUID2
CoInitialize
CoUninitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysStringLen
SysAllocString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
OleCreatePropertyFrame

urlmon

CoInternetParseUrl

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

setupapi

SetupOpenInfFileA
SetupInitDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupInstallFromInfSectionA
SetupCloseInfFile
SetupDefaultQueueCallbackA
SetupTermDefaultQueueCallback

wininet

InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetQueryDataAvailable
InternetSetOptionA
InternetQueryOptionA
InternetOpenA
InternetCrackUrlA
InternetErrorDlg
HttpSendRequestA
InternetSetStatusCallback
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetSetCookieA

crypt32

CertFreeCertificateContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllRegisterServerUser
DllUnregisterServer
DllUnregisterServerUser

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a06712ad8bc54214d3588e626b2f0e83

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

aa:6b:28:4a:0d:6f:33:40:00:00:00:00:55:65:ea:89Certificate

Extended Key Usages

Key Usages

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

urlmon

version

setupapi

wininet

crypt32

Exports

Exports

Sections

.text Size: 403KB - Virtual size: 403KB

.rdata Size: 119KB - Virtual size: 119KB

.data Size: 24KB - Virtual size: 31KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 61KB - Virtual size: 61KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

aa:6b:28:4a:0d:6f:33:40:00:00:00:00:55:65:ea:89
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

.text
Size: 403KB - Virtual size: 403KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 24KB - Virtual size: 31KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 61KB - Virtual size: 61KB